What is Privacy by Design?
Privacy by Design is the principle that the protection of personal data is built into systems, processes and products from the very first design step, rather than added afterwards as a separate measure. Privacy thereby becomes a requirement in the architecture, the technology and the decision-making, just like functionality or availability. In Europe it is not optional advice: Article 25 of the GDPR obliges every controller to apply data protection by design and by default.
🧠 Where does Privacy by Design come from?
The concept was developed in the 1990s by Ann Cavoukian, then Information and Privacy Commissioner of the Canadian province of Ontario. In 2009 she summarised it in seven foundational principles. In October 2010 the International Conference of Data Protection and Privacy Commissioners in Jerusalem unanimously adopted a resolution recognising Privacy by Design as an essential component of privacy protection.
| Foundational principle | What it means in practice |
|---|---|
| Proactive, not reactive | Prevent privacy risks before they arise instead of remedying incidents afterwards |
| Privacy as the default setting | Users’ data is protected without them having to take any action |
| Privacy embedded into design | Privacy is part of the architecture, not an add-on |
| Full functionality (positive-sum) | No false trade-off between privacy and functionality or security; both can be achieved |
| End-to-end security | Protection across the full lifecycle, from collection to destruction |
| Visibility and transparency | How the system works and what was agreed can be verified by individuals and regulators |
| Respect for user privacy | User-centric choices, clear information and strong defaults |
The GDPR does not copy these seven principles word for word. Article 25 codifies their core in legal terms and links it to the principles in Article 5, such as data minimisation and storage limitation.
⚖️ What exactly does Article 25 of the GDPR require?
The GDPR has applied since 25 May 2018. Article 25 has three paragraphs:
- Paragraph 1, by design - the controller implements appropriate technical and organisational measures, such as pseudonymisation, that put the data protection principles into effect. This applies when the means of processing are determined (design and procurement) as well as during the processing itself. The controller weighs the state of the art, the cost of implementation, the nature and context of the processing and the risks to individuals.
- Paragraph 2, by default - by default only the personal data needed for each specific purpose is processed. This covers the amount of data collected, the extent of processing, the storage period and accessibility. By default, personal data must not be made accessible to an indefinite number of people.
- Paragraph 3, certification - an approved certification mechanism (Article 42) can be used as an element to demonstrate compliance.
The European Data Protection Board (EDPB) elaborated on this in Guidelines 4/2019, whose final version 2.0 was adopted on 20 October 2020. Infringing Article 25 falls under Article 83(4): a fine of up to €10 million or 2% of worldwide annual turnover, whichever is higher. In the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises compliance.
Note that the obligation rests with the controller, not with the supplier, who is only encouraged to follow it. In practice, a plant or municipality therefore translates Article 25 into requirements in the tender specification when buying a SCADA, access control or camera system.
🔐 How does Privacy by Design relate to Security by Design?
| Aspect | Privacy by Design | Security by Design |
|---|---|---|
| Protects | Personal data and the rights of individuals | All information, systems and processes |
| Legal basis | Article 25 GDPR (since 2018) | Annex I of the Cyber Resilience Act for products with digital elements (fully applicable from 11 December 2027) |
| Obligation on | The controller | The manufacturer of the product |
| Typical techniques | Data minimisation, pseudonymisation, retention periods, transparency | Hardening, segmentation, patching, secure boot |
| Shared techniques | Encryption, access management, logging | Same |
| Management system | ISO/IEC 27701 | ISO 27001, IEC 62443 |
The two principles are complementary: privacy cannot be guaranteed without good security (Article 32 of the GDPR requires appropriate security), yet a well-secured system can still collect far too much data. Within Dutch government both are embedded in NORA and the BIO. IEC 62443 contains no privacy requirements itself, but its zones and access rules are useful building blocks.
🧱 Which design strategies and measures belong to it?
Dutch researcher Jaap-Henk Hoepman (Radboud University) described eight privacy design strategies in 2014. They make the principle concrete for architects:
| Strategy | Design question | Example measure |
|---|---|---|
| Minimise | Do we really need this data? | Show a job role, not a name, on an operator screen |
| Hide | Who can see or link it? | Encryption, pseudonymisation, blurring faces |
| Separate | Does it have to be stored centrally? | Process locally at the edge |
| Aggregate | Is per-person detail needed? | Forward only shift averages |
| Inform | Do individuals know what happens? | Clear signage at cameras and in the staff handbook |
| Control | Do individuals have a say? | Enable access and correction requests |
| Enforce | Is the policy enforced technically? | RBAC, automatic deletion after the retention period |
| Demonstrate | Can we prove compliance? | DPIA, record of processing activities, audit logging |
Pseudonymisation lowers the risk, but pseudonymised data is still personal data. Only truly anonymised data falls outside the GDPR.
🏭 Where does Privacy by Design affect OT environments?
OT is about machines and processes, but more and more systems also record human behaviour:
- Operator identity - a MES or electronic batch record logs who performed which action. That data is needed for quality and traceability, but not for comparing individual performance.
- Cameras and Vision AI - a camera monitoring a production line often films employees as well. Masking faces or processing images at the edge prevents raw footage from leaving the network.
- RFID badges and location tracking - useful for safety and evacuation, but a tracking system can quietly turn into a staff monitoring system.
- Building automation - access logs, occupancy sensors and smart meters reveal a great deal about the behaviour of employees or residents.
- Historians and data lakes - process data containing user IDs is often kept for years, while the retention period for personal data may be much shorter.
Connecting OT to IT and cloud platforms makes this data more widely accessible, which is exactly what the accessibility clause in Article 25(2) addresses.
🛠️ How do you apply Privacy by Design in an IT/OT project?
- Inventory which personal data the new system processes, including indirect data such as user IDs, IP addresses and video footage.
- Define the purpose of each data flow and remove whatever is not needed.
- Assess the risk. A DPIA (Article 35 GDPR) is mandatory where a high risk is likely. The list published by the Dutch Data Protection Authority includes large-scale or systematic camera surveillance and employee monitoring. A privacy threat model, alongside threat modelling and a risk assessment, helps here.
- Write requirements into the tender: data sharing disabled by default, role-based access following least privilege, configurable retention periods and export functions for subject access requests.
- Involve the works council. In the Netherlands, Article 27(1) of the Works Councils Act gives the works council a right of consent over rules on employees’ personal data (item k) and over systems that can observe attendance, behaviour or performance (item l).
- Test and document the default settings at handover and record them in the record of processing activities.
| Data type in OT | Common practice |
|---|---|
| Security camera footage | As a rule kept for no more than 4 weeks, longer only after an incident |
| Building access logs | Kept briefly and only reviewed after an incident |
| Operator ID in batch records | Kept as long as quality or product legislation requires |
| Raw Vision AI images | Processed at the edge; only the result is stored |
📏 Which standards support Privacy by Design?
- ISO 31700-1:2023 - the first international standard specifically on privacy by design, aimed at consumer goods and services (January 2023), with a Part 2 containing use cases.
- ISO/IEC 27701 - the privacy information management system. The 2019 edition was an extension of ISO 27001; since the 2025 edition it is a standalone, certifiable standard.
- EDPB Guidelines 4/2019 - the authoritative interpretation of Article 25.
New EU rules also call for the same mindset: the AI Act for AI systems such as vision applications, and the Data Act for data generated by connected products.
❓ Frequently asked questions
Is Privacy by Design a legal requirement?
Yes. Since 25 May 2018, Article 25 of the GDPR has required every controller to apply data protection by design and by default. An infringement can lead to a fine of up to €10 million or 2% of worldwide annual turnover.
What is the difference between privacy by design and privacy by default?
Privacy by design means building privacy protection into the design and into the processing itself. Privacy by default means that the default settings process only the data that is necessary, without the user having to change anything. Both are set out in Article 25 of the GDPR.
What are the seven principles of Privacy by Design?
Ann Cavoukian’s seven principles are: proactive not reactive, privacy as the default setting, privacy embedded into design, full functionality, end-to-end security, visibility and transparency, and respect for user privacy. The GDPR does not adopt them literally, but Article 25 builds on them.
Does Privacy by Design also apply to OT systems?
Yes. As soon as an OT system processes personal data, such as operator logins, camera footage or badge records, Article 25 of the GDPR applies. Privacy by Design in OT mainly means recording less identifying data, keeping it for a short time and restricting access.
Is a supplier obliged to apply Privacy by Design?
Article 25 of the GDPR places the obligation on the controller, not on the supplier. The buyer therefore has to include privacy requirements in the tender specification. For the security of products with digital elements, the Cyber Resilience Act additionally applies, and that law does oblige the manufacturer.
Is a DPIA always required for Privacy by Design?
No. Under Article 35 of the GDPR a DPIA is only mandatory where a high risk is likely, such as large-scale camera surveillance or employee monitoring. Even without a DPIA, you must be able to show that every design includes appropriate Privacy by Design measures.
📌 In summary
Privacy by Design means protecting personal data from the drawing board onward, and Article 25 of the GDPR has made that mandatory since 2018.
Ann Cavoukian’s principle is anchored in Europe as data protection by design and by default. With strategies such as minimise, hide, separate and aggregate, with requirements in the tender and with the consent of the works council, you can make OT systems with cameras, badges and operator logins privacy-friendly too. That way you comply with the GDPR and avoid data breaches and reputational damage.